Native Host Troubleshooting

Read the extension’s console, decode the three native messaging host errors, and fix the launch block seen on Citrix, VDI, and other locked-down Windows images

Use this guide when the extension is installed but users are not identified: events arrive with no userId, or the console reports a native messaging host error. It applies to every install path (manual, store, and non-store).

The native host can fail at three distinct points, and the browser reports a different console message for each. Read the message first; the fix depends on it.


Step 1: Open the Service Worker Console

The extension logs the result of every native host call to its service worker console.

  1. Open chrome://extensions (Edge: edge://extensions) and turn on Developer mode
  2. Under Pyze <Customer>, click service worker
  3. Click the reload icon (circular arrow) on the extension card, then read the first Pyze: lines in the console

Step 2: Match the Console Message

Console message What it means Fix
User Hash: <string> Working. The native host ran and returned the hashed user ID. None
Specified native messaging host not found The browser found no NativeMessagingHosts\com.pyze.host registry key (Windows) or manifest file (macOS), or the manifest it points to is missing, invalid, or its path does not exist. IT deployment: re-run the two reg add lines from Step 1 of the deployment guide and confirm pyze-native-host-win-x64.exe and com.pyze.host.json are at C:\Program Files\Pyze\. Manual install: re-run install-windows.bat from the unzipped folder and fully restart the browser.
Access to the specified native messaging host is forbidden Registration is fine, but the extension’s ID is not in the manifest’s allowed_origins. Use the manifest Pyze shipped for your extension ID. Do not hand-edit it. For a manual install, load the package Pyze sent you, not a store build loaded unpacked, which gets a different ID.
Failed to start native messaging host Registration and manifest are fine, but the browser could not launch the host process. See Step 3. Set the NativeHostsExecutablesLaunchDirectly policy.
Nothing at all The extension is not running, or the user is not on an approved site. Confirm the extension is enabled, open an approved site, and reload the extension.

The first three rows are the three points where the chain can break, in order: registration, trust, launch. A machine can pass the first two and still fail the third, so a correct registry key and manifest do not rule out a native host problem.


Step 3: Fix “Failed to start native messaging host”

Why it happens

By default Chrome and Edge do not launch a Windows native host directly. They run it through the command interpreter:

%COMSPEC% /d /s /c "C:\Program Files\Pyze\pyze-native-host-win-x64.exe"

On a locked-down image (Citrix App Layering, VDI, AppLocker, or an EDR rule keyed on the parent process) the launch of cmd.exe under the browser is blocked. The .exe itself is allowed and runs fine when started on its own, which is why the usual checks all pass. The host process never starts, so the extension never receives a user hash and every event leaves without a userId.

The fix

Set NativeHostsExecutablesLaunchDirectly so the browser starts the .exe without cmd.exe in the chain. Run as Administrator, or push the same two values with Group Policy or a Citrix WEM registry action:

reg add "HKLM\SOFTWARE\Policies\Google\Chrome"  /v NativeHostsExecutablesLaunchDirectly /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v NativeHostsExecutablesLaunchDirectly /t REG_DWORD /d 1 /f

Then:

  1. Fully quit the browser. Close every window, then end any leftover chrome.exe or msedge.exe in Task Manager. The policy is read at startup only.
  2. Reopen the browser and go to chrome://policy (Edge: edge://policy). NativeHostsExecutablesLaunchDirectly must be listed as true with no error.
  3. Reopen the service worker console. It should now show User Hash: <string>.

The policy is supported on Chrome 120+ and Edge 121+. On earlier versions it is ignored and the launch still goes through cmd.exe.

The command-line flag --enable-features=LaunchWindowsNativeHostsDirectly is the same switch. It is useful for a one-off test on a single machine, but it is not a deployment method.

Last modified 0001-01-01